Steel River Systems Failed to Protect Consumer Info from ‘Massive’ Data Breach, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit accuses Steel River Systems, LLC of failing to protect consumers’ personal information from a “massive and preventable” data breach between May and July 2022.

According to the 27-page lawsuit, the debt collection company discovered in mid-July that its network had been accessed by an unauthorized third party but later learned the breach had begun more than a month before in late May. The suit relays that the “highly confidential” information compromised during the cyberattack included consumers’ names, Social Security numbers and financial account information.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The case charges that the defendant “recklessly” and “negligently” failed to take reasonable precautions to secure the personally identifiable information (PII) in its network servers—data that was allegedly being stored “unprotected.”

The filing also takes issue with Steel River Systems’ delayed notification of victims, contending that although the ransomware attack was discovered in July, the defendant did not begin informing those impacted until December, five months later.

The letter sent to victims gives only “basic details” of the cyberattack along with suggestions from Steel River Systems about the next steps, the suit claims. The case stresses that those affected are still “in the dark” as to what precise data was disclosed, how the cybercriminals gained access and what steps the company is taking to safeguard consumers’ information in the future.

The complaint alleges that the data breach could have been prevented had the company adequately protected its network and properly encrypted the sensitive information stored therein.

“Defendant’s willful failure to abide by these duties was wrongful, reckless, and grossly negligent in light of the foreseeable risks and known threats,” the filing reads.

By collecting and storing consumers’ personal information, the defendant is legally obliged to protect that data from unauthorized disclosure, the lawsuit claims.

Like other consumers, the plaintiffs, residents of Virginia and California, entrusted their confidential personal information to Steel River Systems with the expectation that the company would properly safeguard it, the case charges. As a result of the data breach, the plaintiffs now face a life-long threat of identity theft, fraud, and other illegal activity, the suit argues.

The lawsuit looks to represent anyone in the United States whose personal and/or financial information was compromised by the data breach discovered by Steel River Systems in July 2022, including those who received notice of the breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.